Guard remember cookie cache deletion

Author: somethingwithproof

lib/auth.php

@@ -142,14 +142,6 @@ function check_auth_cookie() : int|false {
 			}
 
 			if (cacti_sizeof($user_info)) {
-				if (!auth_cookie_user_currently_allowed($user_info)) {
-					db_execute_prepared('DELETE FROM user_auth_cache
-						WHERE user_id = ?',
-						[$user_info['id']]);
-
-					return false;
-				}
-
 				$secret = hash('sha512', $token, false);
 
 				$found  = db_fetch_cell_prepared('SELECT user_id
@@ -161,20 +153,28 @@ function check_auth_cookie() : int|false {
 
 				if (empty($found)) {
 					return false;
-				} else {
-					set_auth_cookie($user_info);
-
-					cacti_log(sprintf('LOGIN: User %s Authenticated via Authentication Cookie from IP Address %s', $user_info['username'], get_client_addr()), false, 'AUTH');
+				}
 
-					db_execute_prepared('INSERT IGNORE INTO user_log
-						(username, user_id, result, ip, time)
-						VALUES
-						(?, ?, 2, ?, NOW())',
-						[$user_info['username'], $user_info['id'], get_client_addr()]
-					);
+				if (!auth_cookie_user_currently_allowed($user_info)) {
+					db_execute_prepared('DELETE FROM user_auth_cache
+						WHERE user_id = ?',
+						[$user_info['id']]);
 
-					return $user_info['id'];
+					return false;
 				}
+
+				set_auth_cookie($user_info);
+
+				cacti_log(sprintf('LOGIN: User %s Authenticated via Authentication Cookie from IP Address %s', $user_info['username'], get_client_addr()), false, 'AUTH');
+
+				db_execute_prepared('INSERT IGNORE INTO user_log
+					(username, user_id, result, ip, time)
+					VALUES
+					(?, ?, 2, ?, NOW())',
+					[$user_info['username'], $user_info['id'], get_client_addr()]
+				);
+
+				return $user_info['id'];
 			}
 		}
 	}

tests/integration/AuthSystemRegressionIntegrationTest.php

@@ -46,6 +46,16 @@ function db_fetch_cell_prepared($sql, $params = []) {
 			return $GLOBALS['auth_integration_group_realms'] ?? 0;
 		}
 
+		if (str_contains($sql, 'FROM user_auth_cache')) {
+			$cache = $GLOBALS['auth_integration_cache'] ?? [];
+
+			foreach ($cache as $row) {
+				if ($row['user_id'] == $params[0] && $row['token'] == $params[1]) {
+					return $row['user_id'];
+				}
+			}
+		}
+
 		return 0;
 	}
 }
@@ -56,6 +66,35 @@ function db_fetch_assoc_prepared($sql, $params = []) {
 	}
 }
 
+if (!function_exists('db_fetch_row_prepared')) {
+	function db_fetch_row_prepared($sql, $params = []) {
+		return $GLOBALS['auth_integration_users'][$params[0]] ?? [];
+	}
+}
+
+if (!function_exists('db_execute_prepared')) {
+	function db_execute_prepared($sql, $params = []) {
+		$GLOBALS['auth_integration_executed'][] = [
+			'sql'    => $sql,
+			'params' => $params,
+		];
+
+		return true;
+	}
+}
+
+if (!function_exists('db_table_exists')) {
+	function db_table_exists($table) {
+		return $table == 'user_auth_cache';
+	}
+}
+
+if (!function_exists('get_guest_account')) {
+	function get_guest_account() {
+		return (int) read_config_option('guest_user');
+	}
+}
+
 require_once $root . '/lib/auth.php';
 
 test('auth subsystem regression coverage spans cookie login, 2fa, reset tokens, basic auth, and profile mutations', function () use ($root) {
@@ -117,3 +156,44 @@ function db_fetch_assoc_prepared($sql, $params = []) {
 		'show_preview' => '',
 	]))->toBeTrue();
 });
+
+test('remember-me cookie authorization verifies token before deleting cache rows', function () {
+	$GLOBALS['auth_integration_config'] = [
+		'auth_cache_enabled' => 'on',
+		'guest_user'         => 0,
+	];
+	$GLOBALS['auth_integration_realms']  = 1;
+	$GLOBALS['auth_integration_groups']  = [];
+	$GLOBALS['auth_integration_users']   = [
+		42 => [
+			'id'           => 42,
+			'username'     => 'disabled',
+			'realm'        => 0,
+			'enabled'      => '',
+			'show_tree'    => '',
+			'show_list'    => '',
+			'show_preview' => '',
+		],
+	];
+	$GLOBALS['auth_integration_cache']    = [
+		[
+			'user_id' => 42,
+			'token'   => hash('sha512', 'valid-token', false),
+		],
+	];
+	$GLOBALS['auth_integration_executed'] = [];
+
+	$_COOKIE['cacti_remembers'] = '42,-1,forged-token';
+
+	expect(check_auth_cookie())->toBeFalse()
+		->and($GLOBALS['auth_integration_executed'])->toBeEmpty();
+
+	$_COOKIE['cacti_remembers'] = '42,-1,valid-token';
+
+	expect(check_auth_cookie())->toBeFalse()
+		->and($GLOBALS['auth_integration_executed'])->toHaveCount(1)
+		->and($GLOBALS['auth_integration_executed'][0]['sql'])->toContain('DELETE FROM user_auth_cache')
+		->and($GLOBALS['auth_integration_executed'][0]['params'])->toBe([42]);
+
+	unset($_COOKIE['cacti_remembers']);
+});